[ Cookies ]
Cookie Policy
Last updated: 4 September 2026
This policy describes the cookies and similar technologies (browser local / session storage) used on chmielewski.studio. We keep it minimal: only what is necessary to run the site and - only with your consent - site and offer analytics plus advertising measurement. Alongside these we run a traffic count that neither stores nor reads anything on your device (see section 3). You can enable each of these two categories separately. The processing of personal data is described in our privacy policy.
1. What cookies and browser storage are
Cookies are small text files stored on your device. Alongside them we use the browser “local storage" (localStorage) and “session storage" (sessionStorage) - they work similarly, keeping small pieces of data between page views. In this policy “cookies" covers all of these mechanisms.
2. Which cookies we use
| Key / mechanism | Category | Purpose | Duration and place |
|---|---|---|---|
studio-consent | Necessary | Remembers your cookie consent choice and a pseudonymous consent identifier (consentId) | localStorage, up to 12 months |
studio-consent-outbox | Necessary | Temporary buffer of consent-registry entries until they are delivered (if the network fails) | localStorage, until sent |
| Cloudflare Turnstile | Necessary | Anti-bot verification of the booking form | technical token, short / session |
execedge-offer-lang | Necessary (functional) | Remembers the selected offer language | localStorage |
execedge-offer-pw | Necessary | Keeps the offer unlocked within the session | sessionStorage, until the tab closes |
studio-track-sid | Analytics (with consent) | Pseudonymous visit identifier to measure interest in the offer | localStorage, until consent is withdrawn / data cleared |
__obref (OpenAI) | Marketing (with consent) | Pseudonymous browser identifier the OpenAI pixel uses to link a visit to an earlier encounter with an ad | cookie, 12 months |
__oppref (OpenAI) | Marketing (with consent) | Ad click identifier (from a URL parameter), to attribute a conversion to a campaign | cookie, 30 days |
oaiq_consent / __oaiq_consent (OpenAI) | Marketing (with consent) | Stores the consent state passed to the OpenAI pixel | cookie and localStorage, until consent is withdrawn |
Site analytics run on Google Analytics 4 (provider: Google Ireland Limited). We use it only to learn which routes bring people here and which content is useful - we do not build advertising profiles and we do not combine this data with what you enter in the booking form. We do not run it until you consent: without your consent the Google script is not loaded at all, so there is neither a request to Google servers nor any of the cookies above. Once you consent, Google processes among other things the address of the page you visit, the referring address, an approximate location (country and city level), device and browser type, and the identifiers stored in the cookies above. Data may be transferred to the United States - Google declares participation in the EU-U.S. Data Privacy Framework, on which we rely for that transfer. You can withdraw consent at any time; measurement then stops and we delete the _ga* files.
The marketing cookies come from a third party - OpenAI - and serve only to measure how effective our own ads are (how many people reached the site after seeing an ad and then used the form). We do not run them until you consent: without your consent the OpenAI script is not loaded at all, so neither a connection to OpenAI servers nor any of the files above comes into existence. We do not sell data and we do not build advertising profiles of our own. Once you consent, the pixel sends OpenAI more than the identifiers above: as you fill in a form it recognises contact details and transmits them as irreversible hashes (SHA-256 of your e-mail address, first name and surname) - used solely to match conversions, and the original data cannot be recovered from them. A booked consultation is additionally confirmed by our server, which sends the same event with the same e-mail hash so that one booking is neither counted twice nor lost when a browser blocks the script - again only after you have consented.
3. Categories and legal basis
- Necessary - required for the site to work (form security, language and session memory, storing your consent). They do not require consent (storage strictly necessary to provide the service, ePrivacy).
- Analytics - measuring site traffic (Google Analytics 4) and interest in the offer (our own counter). We enable them only after you consent in the banner (Art. 6(1)(a) GDPR). Until you consent we store no analytics identifier and do not load the Google script.
- Marketing - measuring how effective our ads are (OpenAI conversion pixel). We enable them only after you give separate consent in the banner (Art. 6(1)(a) GDPR). Consent to analytics is not consent to marketing - they are two independent switches.
- Measurement without files and without consent - alongside the above we count visits with Vercel Web Analytics, which neither stores nor reads anything on your device (no cookies, no browser storage). It recognises a visit by an irreversible hash computed server-side from the request itself; the hash is discarded after 24 hours, so you cannot be tracked across days or across sites. Because we do not reach into your device storage, this measurement does not require consent, and the basis for processing is our legitimate interest in knowing the real scale of traffic (Art. 6(1)(f) GDPR). You may object - see the privacy policy.
4. Managing your consent
On your first visit we show a banner with separate switches for analytics and marketing. “Only necessary” rejects both categories, “Save choice” stores exactly what you tick, “Accept all” enables both. Refusing is just as easy as consenting - no option is visually favoured or pre-ticked. You can change or withdraw your choice at any time:
We record every decision you make (consent or refusal) in a consent registry so that we can demonstrate it (accountability): a pseudonymous consent identifier (consentId), your category choice, the policy version, the time, and an irreversible hash of your IP address - not the raw IP and nothing that identifies you by name. The details and the registry recipient are described in our privacy policy.
You can also delete and block cookies and site storage in your browser settings - see your browser documentation for help.
5. Changes to this policy
We may update this policy when the technologies we use or the law change. The current version is always available at this address, with the date of the latest update shown at the top of the page.